{"id":102301,"date":"2021-11-16T21:36:47","date_gmt":"2021-11-16T19:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4"},"modified":"2021-11-16T21:36:47","modified_gmt":"2021-11-16T19:36:47","slug":"blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","title":{"rendered":"Blacksmith \u2014 nov\u00fd \u00fatok na pam\u00e4\u0165 DRAM a \u010dipy DDR4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Skupina v\u00fdskumn\u00edkov z ETH Z\u00fcrich, Vrije Universiteit Amsterdam a spolo\u010dnosti Qualcomm zverejnila nov\u00fa met\u00f3du \u00fatoku triedy RowHammer, ktor\u00e1 umo\u017e\u0148uje meni\u0165 obsah jednotliv\u00fdch bitov dynamickej opera\u010dnej pam\u00e4te (DRAM). \u00datoku bolo priraden\u00e9 k\u00f3dov\u00e9 meno Blacksmith a identifik\u00e1tor CVE-2021-42114. Probl\u00e9mu podlieha mnoho DDR4 \u010dipov, ktor\u00e9 maj\u00fa ochranu proti predt\u00fdm zn\u00e1mym met\u00f3dam triedy RowHammer. N\u00e1stroj na testovanie svojich syst\u00e9mov na zranite\u013enos\u0165 bol zverejnen\u00fd na GitHub. <\/p>\n

Pripom\u00edname, \u017ee \u00fatoky triedy RowHammer umo\u017e\u0148uj\u00fa skresli\u0165 obsah jednotliv\u00fdch bitov pam\u00e4te cyklick\u00fdm \u010d\u00edtan\u00edm \u00fadajov z susedn\u00fdch pam\u00e4\u0165ov\u00fdch buniek. Ke\u010f\u017ee pam\u00e4\u0165 DRAM je dvojrozmern\u00e9 pole buniek, z ktor\u00fdch ka\u017ed\u00e1 sa sklad\u00e1 z kondenz\u00e1tora a tranzistora, nepretr\u017eit\u00e9 \u010d\u00edtanie jednej a tej istej oblasti pam\u00e4te vedie k fluktu\u00e1ci\u00e1m nap\u00e4tia a anom\u00e1li\u00e1m, ktor\u00e9 sp\u00f4sobuj\u00fa mal\u00e9 straty n\u00e1boja v susedn\u00fdch bunk\u00e1ch. Ak je intenzita \u010d\u00edtania ve\u013ek\u00e1, susedn\u00e1 bunka m\u00f4\u017ee strati\u0165 dostato\u010dne ve\u013ek\u00fd objem n\u00e1boja a \u010fal\u0161\u00ed cyklus regener\u00e1cie nesta\u010d\u00ed obnovi\u0165 jej p\u00f4vodn\u00fd stav, \u010do vedie k zmene hodnoty ulo\u017een\u00fdch \u00fadajov v bunke. <\/p>\n

Na ochranu pred RowHammer v\u00fdrobcovia \u010dipov navrhli mechanizmus TRR (Target Row Refresh), ktor\u00fd chr\u00e1ni pred skreslen\u00edm buniek v susedn\u00fdch riadkoch. Av\u0161ak, preto\u017ee ochrana bola zalo\u017een\u00e1 na princ\u00edpe \u201ebezpe\u010dnos\u0165 prostredn\u00edctvom nejasnosti\u201c, probl\u00e9m nevyrie\u0161ila z\u00e1sadne, ale chr\u00e1nila len pred zn\u00e1mymi \u0161pecifick\u00fdmi pr\u00edpadmi, \u010do umo\u017enilo \u013eahko n\u00e1js\u0165 sp\u00f4soby ob\u00eddenia ochrany. Napr\u00edklad v m\u00e1ji spolo\u010dnos\u0165 Google navrhla met\u00f3du Half-Double, na ktor\u00fa ochrana TRR nefungovala, preto\u017ee \u00fatok zasahoval bunky, ktor\u00e9 priamo nepriliehali k cie\u013eovej. <\/p>\n

Nov\u00e1 met\u00f3da Blacksmith pon\u00faka in\u00fd sp\u00f4sob ob\u00eddenia ochrany TRR, zalo\u017een\u00fd na heterog\u00e9nnom pr\u00edstupe s r\u00f4znou frekvenciou pr\u00edstupu k dvom alebo viacer\u00fdm agresorom, aby vyvolala \u00fanik n\u00e1boja. Na ur\u010denie vzoru pr\u00edstupu k pam\u00e4ti, ktor\u00fd vedie k \u00faniku n\u00e1boja, bol vyvinut\u00fd \u0161peci\u00e1lny fuzzer, ktor\u00fd automaticky prisp\u00f4sobuje parametre \u00fatoku pre konkr\u00e9tny \u010dip, variabilne meniac poradie, intenzitu a systematickos\u0165 pr\u00edstupu k bunk\u00e1m. <\/p>\n

Podobn\u00fd pr\u00edstup, ktor\u00fd nie je spojen\u00fd s ovplyv\u0148ovan\u00edm t\u00fdch ist\u00fdch buniek, rob\u00ed aktu\u00e1lne met\u00f3dy ochrany TRR neefekt\u00edvnymi, ktor\u00e9 sa v jednom alebo druhom smere zredukuj\u00fa na po\u010d\u00edtanie po\u010dtu opakovan\u00fdch pr\u00edstupov k bunk\u00e1m a pri dosiahnut\u00ed ur\u010dit\u00fdch hodn\u00f4t iniciuj\u00fa op\u00e4tovn\u00e9 nabitie susedn\u00fdch buniek. V Blacksmith sa pr\u00edstupov\u00fd vzor okam\u017eite rozprestiera na nieko\u013eko buniek z r\u00f4znych str\u00e1n od cie\u013eovej, \u010do umo\u017e\u0148uje dosiahnu\u0165 \u00fanik n\u00e1boja bez dosiahnutia prahov\u00fdch hodn\u00f4t. <\/p>\n

Met\u00f3da sa uk\u00e1zala by\u0165 podstatne \u00fa\u010dinnej\u0161ia ako predt\u00fdm navrhovan\u00e9 sp\u00f4soby ob\u00eddenia TRR \u2014 v\u00fdskumn\u00edkom sa podarilo dosiahnu\u0165 skreslenie bitov vo v\u0161etk\u00fdch 40 ned\u00e1vno zak\u00fapen\u00fdch r\u00f4znych DDR4 pam\u00e4\u0165ov\u00fdch \u010dipov od v\u00fdrobcov Samsung, Micron, SK Hynix a nezn\u00e1meho v\u00fdrobcu (u 4 \u010dipov nebol v\u00fdrobca uveden\u00fd). Na porovnanie, predt\u00fdm navrhnut\u00e1 rovnak\u00fdmi v\u00fdskumn\u00edkmi met\u00f3da TRRespass bola \u00fa\u010dinn\u00e1 len pre 13 z 42 testovan\u00fdch vtedy \u010dipov. <\/p>\n

Vo v\u0161eobecnosti sa predpoklad\u00e1, \u017ee met\u00f3da Blacksmith je aplikovate\u013en\u00e1 na 94% v\u0161etk\u00fdch DRAM \u010dipov dostupn\u00fdch na trhu, ale pod\u013ea vyhl\u00e1senia v\u00fdskumn\u00edkov s\u00fa niektor\u00e9 \u010dipy zranite\u013enej\u0161ie a jednoduch\u0161ie na \u00fatok ako in\u00e9. Vyu\u017eitie k\u00f3dov na opravu ch\u00fdb (ECC) v \u010dipoch a zdvojn\u00e1sobenie frekvencie obnovovania pam\u00e4te neposkytuje \u00fapln\u00fa ochranu, ale komplikuje zneu\u017eitie. Zauj\u00edmav\u00e9 je, \u017ee probl\u00e9m nemo\u017eno zablokova\u0165 v u\u017e vydan\u00fdch \u010dipoch a vy\u017eaduje zavedenie novej ochrany na hardv\u00e9rovej \u00farovni, preto \u00fatok zostane relevantn\u00fd e\u0161te mnoho rokov. <\/p>\n

Ako praktick\u00e9 pr\u00edklady s\u00fa uveden\u00e9 met\u00f3dy aplik\u00e1cie Blacksmith na zmenu obsahu z\u00e1znamov v tabu\u013eke str\u00e1n pam\u00e4te (PTE, page table entry) na z\u00edskanie privil\u00e9gi\u00ed jadra, po\u0161kodenie ulo\u017een\u00e9ho v pam\u00e4ti otvoren\u00e9ho k\u013e\u00fa\u010da RSA-2048 v OpenSSH (otvoren\u00fd k\u013e\u00fa\u010d je mo\u017en\u00e9 uvies\u0165 do zhody so s\u00fakromn\u00fdm k\u013e\u00fa\u010dom \u00fato\u010dn\u00edka na pripojenie k VM obete) a obch\u00e1dzanie overovania opr\u00e1vnen\u00ed cez modifik\u00e1ciu pam\u00e4te procesu sudo na z\u00edskanie opr\u00e1vnen\u00ed root. V z\u00e1vislosti od \u010dipu na zmenu jedn\u00e9ho cie\u013eov\u00e9ho bitu je potrebn\u00e9 od 3 sek\u00fand do nieko\u013ek\u00fdch hod\u00edn vykon\u00e1vania \u00fatoku. virtu\u00e1lnom stroji<\/a> k\u00a0zodpovedaj\u00facemu uzavret\u00e9mu k\u013e\u00fa\u010du \u00fato\u010dn\u00edka na pripojenie k VM obete) a obch\u00e1dzanie overovania opr\u00e1vnen\u00ed cez modifik\u00e1ciu pam\u00e4te procesu sudo na z\u00edskanie opr\u00e1vnen\u00ed root. V z\u00e1vislosti od \u010dipu na zmenu jedn\u00e9ho cie\u013eov\u00e9ho bitu je potrebn\u00e9 od 3 sek\u00fand do nieko\u013ek\u00fdch hod\u00edn vykon\u00e1vania \u00fatoku.

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center> <\/p>\n

Dodatkovo sa m\u00f4\u017ee zd\u00f4razni\u0165 publik\u00e1cia otvoren\u00e9ho r\u00e1mca LiteX Row Hammer Tester na testovanie ochrany pam\u00e4te pred \u00fatokmi typu RowHammer, ktor\u00fd vyvinula spolo\u010dnos\u0165 Antmicro na objedn\u00e1vku Google. R\u00e1mec je zalo\u017een\u00fd na vyu\u017eit\u00ed FPGA na \u00fapln\u00e9 ovl\u00e1danie pr\u00edkazov, ktor\u00e9 sa posielaj\u00fa priamo do DRAM \u010dipu, aby sa eliminoval dopad pam\u00e4\u0165ov\u00e9ho kontrol\u00e9ra. Na interakciu s FPGA je k dispoz\u00edcii n\u00e1stroj na programovanie v jazyku Python. Br\u00e1na na b\u00e1ze FPGA obsahuje modul pre hromadn\u00fd prenos \u00fadajov (ur\u010duje vzory pr\u00edstupu k pam\u00e4ti), Payload Executor, ovl\u00e1da\u010d na b\u00e1ze LiteDRAM (spracov\u00e1va v\u0161etku po\u017eadovan\u00fa logiku pre DRAM vr\u00e1tane aktiv\u00e1cie riadkov a aktualiz\u00e1cie pam\u00e4te) a CPU VexRiscv. V\u00fdvoj projektu sa distribuuje pod licenciou Apache 2.0. Podporuje sa pou\u017eitie r\u00f4znych FPGA platforiem, vr\u00e1tane Lattice ECP5, Xilinx Series 6, 7, UltraScale a UltraScale+.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430, \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0431\u0438\u0442\u043e\u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (DRAM). \u0410\u0442\u0430\u043a\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Blacksmith \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2021-42114. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u043c\u043d\u043e\u0433\u0438\u0435 \u0447\u0438\u043f\u044b DDR4, \u0441\u043d\u0430\u0431\u0436\u0451\u043d\u043d\u044b\u0435 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 \u0440\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102301","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Blacksmith \u2014 nov\u00fd \u00fatok na DRAM pam\u00e4\u0165 a DDR4 \u010dipy | ProHoster","description":"Skupina v\u00fdskumn\u00edkov zo \u0160vaj\u010diarskej feder\u00e1lnej technickej vysokej \u0161koly v Z\u00fcrichu, Amsterdamskej univerzity a spolo\u010dnosti Qualcomm publikovala nov\u00fa met\u00f3du \u00fatoku typu RowHammer, ktor\u00e1 umo\u017e\u0148uje zmeni\u0165 obsah.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Blacksmith \u2014 \u043d\u043e\u0432\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u0430\u043c\u044f\u0442\u044c DRAM \u0438 \u0447\u0438\u043f\u044b DDR4 | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0428\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e\u0439 \u0432\u044b\u0441\u0448\u0435\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0448\u043a\u043e\u043b\u044b \u0426\u044e\u0440\u0438\u0445\u0430, \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c\u0441\u043a\u043e\u0433\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualcomm \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043a\u043b\u0430\u0441\u0441\u0430 RowHammer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/blacksmith-novaya-ataka-na-pamyat-dram-i-chipy-ddr4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:47+00:00","article:modified_time":"2021-11-16T19:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102301","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:42","updated":"2022-10-05 17:04:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/102301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=102301"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/102301\/revisions"}],"predecessor-version":[{"id":164192,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/102301\/revisions\/164192"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=102301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=102301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=102301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}